#Cloudflare Tunnels with authentik

1 messages · Page 1 of 1 (latest)

radiant hollow
#

I've looked through all of the other discussions about this and feel like yet again I'm missing something very simple. The short version of what I'm attempting to set up (is a requirement of this particular setup) is:

Internet->Cloudflare Tunnel->Application

Currently, I have all applications running through tunnels, pointing to their localhost:port configurations. I am able to access all applications without issue, including authentik.

I set up all the applications through authentik, configured all of the OIDC information on both sides of the application, even verified the setup using a local development environment. However, as soon as it's behind the Cloudflare tunnel every SSO exchange fails at the token/ endpoint with a 400 error and description of

    "error": "invalid_client",
    "error_description": "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)"
} ```

I'm seeing the exact same error in the authentik logs as in the browser and cannot figure out the next step in troubleshooting how to get past this issue, especially considering the exact same setup works as long as Cloudflare is not in the mix. 

Has anyone set this up like this before and have any good suggestions for next steps?
radiant hollow
#

I should mention, watching the traffic, the correct client tokens are being passed (per application), so I'm not sure what the next step is to figure out what is failing. I can only assume it's a communication error of some sort since it's all applications that are failing, not just one or two. I've even gone as far as to completely disable the CF firewall in an attempt to see if things will work without it in place.

worldly fable
#

Have you tested the OIDC?
Which policies have you set for the cloudflare application?

image.png
radiant hollow
#

Oddly, OIDC from CF to authentik works perfectly. It's from any other service behind the tunnels that seems to fall down.

That said, maybe I'm misunderstanding something, I didn't see a way to use the CF applications to actually pass SSO through. Every time I've used it, it seems to just secure the front-end, not actually provide authentication to the receiving application.

potent flint
#

CF has its own OIDC provider you can plug into your app. You’ll have 2 applications set up on the dashboard

radiant hollow
#

Ooohhh, I'll give that a shot and see what happens